patchlwIP - A Lightweight TCP/IP stack - Patches: patch #10124, bug: LWIP_DHCP_MAX_DNS_SERVERS...


You are not allowed to post comments on this tracker with your current authentication level.

patch #10124: bug: LWIP_DHCP_MAX_DNS_SERVERS < DNS_MAX_SERVERS is causing memory corruption

Submitted by:  Borys Szefler <bsz>
Submitted on:  Tue 19 Oct 2021 08:33:42 AM UTC
Category:  DHCP Priority:  7 - High
Status:  None Privacy:  Public
Assigned to:  None Open/Closed:  Open
Planned Release:  None
* Mandatory Fields

Add a New Comment (Rich Markup)

Comment Type & Canned Response:
       No canned response available


Tue 19 Oct 2021 08:33:42 AM UTC, original submission:  

Bug reproduction:


Bug cause:
 In above case DHCP_OPTION_IDX_MAX = 9, so dhcp_rx_options_val and   dhcp_rx_options_given tables have size = 9.

 Then in dhcp_parse_reply function(dhcp.c file) we have
decode_len = LWIP_MIN(len, 4 * DNS_MAX_SERVERS); which next is causing incrementing decode_idx to 9 and reading/writing above tables with idx = 9 which is causing memory corruption.

 decode_len = LWIP_MIN(len, 4 * DNS_MAX_SERVERS); resolves this problem

Borys Szefler <bsz>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by bsz (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.





    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-10-19 bsz Attached File- => Added dhcp_max_servers_memory_corruption_fix.patch, #52123

    Back to the top

    Powered by Savane 3.9